Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack

MITRE Techniques

• [T1566.001] Spearphishing Attachment – Victims were lured with job offers and malicious files sent in phishing messages (‘targeted spear-phishing lures centered on attractive job opportunities’).
• [T1036] Masquerading – The operators impersonated recruiters, Enveil, and legitimate PDF software to make malicious files appear trustworthy (‘posing as recruiters’; ‘impersonating Enveil’).
• [T1328] Spam / Search Engine Optimization Poisoning – Malicious download sites were boosted in search results to increase credibility (‘search engine optimization (SEO) techniques’).
• [T1574.001] DLL Search Order Hijacking / DLL Sideloading – A legitimate signed executable loaded a malicious DLL to execute payloads (‘loaded via DLL sideloading’).
• [T1027] Obfuscated Files or Information – Payloads and webshell data were encrypted, XORed, Base64-encoded, or otherwise obscured (‘encrypted zip archive’; ‘single-byte XOR key (0x39)’).
• [T1106] Native API – The malware used Windows APIs and low-level system interfaces for desktop capture and exploit execution (‘uses standard Windows USER32 and GDI APIs’; ‘invokes NtSetSystemInformation’).
• [T1055] Process Injection – FudModule injected a payload into a SYSTEM process and Troy performed reflective DLL injection (‘injects a payload into a SYSTEM process’; ‘reflective DLL injection’).
• [T1105] Ingress Tool Transfer – MISTPEN retrieved additional modules from OneDrive and RelayShell transferred data through files (‘retrieve additional modules’; ‘file-based communication channel’).
• [T1056.001] Keylogging / Input Capture? Not mentioned – No reliable evidence of this technique appears in the article; omitted.
• [T1082] System Information Discovery – Multiple modules collected host, OS, user, and process details (‘collects system and process information’; ‘collects basic system information’).
• [T1057] Process Discovery – PvPlugin enumerated running processes and collected PID/PPID data (‘collecting detailed information about running processes’).
• [T1113] Screen Capture – OneScreenCapture captured the desktop and returned it for exfiltration (‘capturing the current desktop’).
• [T1547.001] Registry Run Keys / Startup Folder – MISTPEN installed persistence to ensure execution after reboot (‘ensures that MISTPEN is automatically executed after system reboot’).
• [T1068] Exploitation for Privilege Escalation – The attackers exploited CVE-2026-68820 in AFD.sys to gain SYSTEM privileges (‘exploit the zero day vulnerability CVE-2026-68820’).
• [T1003] OS Credential Dumping – Not mentioned – The article does not describe credential dumping; omitted.
• [T1071.001] Web Protocols – Command-and-control traffic used HTTP to communicate with servers and relays (‘establishing an HTTP connection’; ‘web shell’).
• [T1090] Proxy – RelayShell turned compromised servers into relay nodes between victim and operator (‘repurposes compromised web servers as relay nodes’).
• [T1021] Remote Services – Troy supported remote access and command execution over C2 (‘providing a broad range of remote access’).
• [T1195] Supply Chain Compromise – Not mentioned – the campaign did not rely on supply-chain compromise; omitted.
• [T1102] Web Service – MISTPEN used Microsoft Graph API and OneDrive as a communications channel (‘uses Microsoft Graph API to access OneDrive’).
• [T1133] External Remote Services – Attackers accessed RelayShell through shared VPN services (‘accessing RelayShell through shared VPN services, including ExpressVPN’).